Hybrid Graph-Based Representation

3. The system of claim 2, wherein the computed temporal trajectories are used to do at least one of: anomaly detection, behavior characterization, user identification, device identification, and application identification.

4. The system of claim 1, wherein the first abstract temporal graph is generated based one or more of: an IP address, a Media Access Control (MAC) address, a Uniform Resource Locator (URL), a Session Initiation Protocol (SIP) address, a Transmission Control Protocol (TCP) flag, an H.323 address, a telephone number, an application layer address, a presentation layer address, a transport layer address, a session layer address, a data link layer address, a virtual machine, a container, a micro service, and a physical address.

5. The system of claim 1, wherein the plurality of IP address nodes (i) and the plurality of edges each have one or more associated attributes.

6. The system of claim 1, wherein the first abstract temporal graph is not generated for display to a user.

7. The system of claim 1, wherein the microprocessor readable and executional instructions further cause the microprocessor to: get one or more key attributes from a user interface, wherein the one or more key attributes are used to generate the first abstract temporal graph.

11. The method of claim 10, wherein the computed temporal trajectories are used to do at least one of: anomaly detection, behavior characterization, user identification, device identification, and application identification.

12. The method of claim 9, wherein the first abstract temporal graph is generated based one or more of: an IP address, a Media Access Control (MAC) address, a Uniform Resource Locator (URL), a Session Initiation Protocol (SIP) address, a Transmission Communication Protocol (TCP) flag, an H.323 address, a telephone number, an application layer address, a presentation layer address, a transport layer address, a session layer address, a data link layer address, a virtual machine, a container, a micro service, and a physical address.

13. The method of claim 9, wherein the plurality of IP address nodes (i) and the plurality of edges each have one or more associated attributes.

17. The non-transient computer readable medium of claim 16, wherein the computed temporal trajectories are used to do at least one of: anomaly detection, behavior characterization, user identification, device identification, and application identification.

18. The non-transient computer readable medium of claim 15, wherein the first abstract temporal graph is generated based one or more of: an IP address, a Media Access Control (MAC) address, a Uniform Resource Locator (URL), a Session Initiation Protocol (SIP) address, a Transmission Control Protocol (TCP) flag, an H.323 address, a telephone number, an application layer address, a presentation layer address, a transport layer address, a session layer address, a data link layer address, a virtual machine, a container, a micro service, and a physical address.

19. The non-transient computer readable medium of claim 15, wherein the plurality of IP address nodes (i) and the plurality of edges each have one or more associated attributes.